Emvco Application Kernel Level 2 CONTACT

Emvco Application Kernel Level 2 CONTACT

NOTE 6:SMARTCARD TERMINALS

Contents

General:

EMVCo Application Kernel Level 2 – CONTACT

EMV Application Kernel - Level 2 Approval Prerequisites

EMV Application Kernel - Level 2 Type Approval Procedures

EMVCo Application Kernel - L2 CONTACTLESS

EMVCoApplication Kernel - L2 CONTACTLESS Type Approval Procedures

MasterCard PayPass – Acceptance Device Approval Process

Overview of the ADA Process

TQM and PCI Processes

Terminal Quality Management

PCI PIN Entry Device Approval

General:

The provisions of the contract entered into between TÜV SÜD Product Service and the application providers are entirely outside of EMVCo’s and any Payment Scheme’s scope. However, the likely areas for inclusion are mentioned below for information purposes only:

  • Any laboratory requirements needed for testing, including any software application that requires interfacing with TUV SUD Product Service test equipment, e.g. host emulator, etc.
  • Reference to the contract between the application providers, EMVCo and Any Payment Scheme.
  • Agreement of mutual co-operation in providing information and assistance where needed
  • Lead-time for the execution of the type approval tests
  • Arrangement for the preparation and delivery of samples
  • Right to keep all samples for the duration of the test procedure
  • Right to keep all approved samples for a period of up to 7 years after the conclusion of testing.
    Note: samples are retained for subsequent testing purposes and the application provider must provide the necessary support to TUV SUD Product Service to ensure the kernel remains fully functional.
  • Recognition that no infringement on the independence or impartiality of the testing laboratory will be allowed during or after testing
  • Agreement on the boundaries of use of the test report
  • Provisions for conflict resolution

EMVCo Application Kernel Level 2 – CONTACT

EMV Application Kernel - Level 2 Approval Prerequisites

  • The following are required for an application provider to obtain an EMV application kernel approval:
  • Level 1 approval of the Interface Module (IFM) being used in the terminal hardware configuration submitted for level 2 testing. The IFM used in the terminal under test shall have a valid Letter of Approval (LoA) at the time of the initial submission.
  • Signed contract between application provider and EMVCo
  • Payment for EMVCo administrative fees
  • Products being submitted for Renewal testing must have a valid LoA at the time the Renewal test cycle begins

EMV Application Kernel - Level 2 Type Approval Procedures

The type approval procedure followed by application providers, laboratories, and EMVCo includes the following:

  • Application provider obtains registration information from the EMVCo web site or from TUV SUD Product Service
  • Application provider submits a completed registration template to the EMVCo Type Approval Secretariat
  • Application provider obtains the Level 2 EMVCo/vendor contract from EMVCo, the EMVCo web site or from TUV SUD Product Service.
  • Application provider concludes a contract with the TUV SUD Product Service in respect of the EMV application kernel to be tested and the number of configurations that will be supported by that kernel
  • TUV SUD Product Service submits a copy of the completed ICS statement to EMVCo prior to performing testing. The ICS statement is reviewed for accuracy and then archived for later comparison. The Type Approval Secretariat will respond with a confirmation that the submitted ICS is acceptable for testing
  • TUV SUD Product Service performs testing of the submitted EMV application kernel against the published Level 2 test requirements and test cases
  • Application provider concludes the contract with EMVCo. A contract between EMVCo and the application provider must be completed before test results are submitted to EMVCo for evaluation and potential type approval
  • Application provider submits a completed Request For Approval (RFA) form to EMVCo. Based on the RFA form EMVCo will provide Application provider with an invoice.
  • Based on the received invoice Application provider pays the administrative fees to EMVCo.
  • On Application provider’s request, TUV SUD Product Service submits the ICS (with checksum) and test results for all kernel configurations tested to the EMVCo Type Approval Secretariat.
  • If fee payment is confirmed by EMVCo Finance Secretariat, analysis of the ICS and test results by EMVCo and, if appropriate approval notification
  • Type approved EMV application kernels are posted on the EMVCo web site after approval notification.
  • Approved application kernels are retained by TUV SUD Product Service for a period of 3 years as of the date of approval. The vendor is responsible for providing support as necessary to maintain the kernel in an operational state to accommodate any subsequent testing or analysis that may be deemed necessary by EMVCo.

EMVCo Application Kernel - L2 CONTACTLESS

EMVCoApplication Kernel - L2 CONTACTLESS Type Approval Procedures

The type approval procedure applied by Product Providers, Laboratories, auditors and EMVCo includes the following:

  • Product Providers conclude the contract with EMVCo. A contract between EMVCo and the Product Providers must be completed before test results are submitted to EMVCo for evaluation and potential type approval.
  • Product Providers obtain registration forms from the EMVCo web site or from an EMVCo accredited Laboratory.
  • Product Providers submit a completed registration template to the EMVCo CATA Secretariat.
  • Product Providers obtain the Contactless EMVCo/Product Provider contract from the EMVCo web site. This contract covers Product approval and Modular Architecture Compliance (if needed).
  • In case of ‘Optimized Process’ selection by Product Providers:
  • Product Providers select a Compliance Auditor from the qualified Auditor list published on the EMVCo web site,
  • Product Providers conclude a contract with the qualified Auditor in respect of the Modular Architecture to be audited,
  • Product Provider submits relevant documentation to the Auditor,
  • Auditor performs the audit,
  • Product Providers validate the audit results,
  • Product Providers submit a completed Request for Compliance form to EMVCo. Based on the Request For Compliance form EMVCo will provide Product Provider with an invoice,
  • Based on the received invoice the Product Provider shall settle the administrative fees with EMVCo,
  • Product Providers submit the audit report results to the EMVCo CATA Secretariat,
  • If the fee payment is confirmed by EMVCo Financial Secretariat, analysis of the audit report results by EMVCo and, if appropriate compliance notification.
  • The Laboratory performing Book A & B testing, Independency testing and Modular testing (if ‘Optimized Process’) is referenced as the Main Laboratory.
  • Product Providers conclude a contract with TUV SUD Product Serviceand selected Laboratories in respect of the Product to be tested.
  • Product Providers and selected Laboratories shall fill out the ICS; one ICS for the overall Product (called Contactless Product ICS) and one ICS for each Kernel C-n present. The Contactless Product ICS is managed by the Main Laboratory and it is the responsibility to share this ICS (after EMVCo Approval of the ICS) with the other selected Laboratories (if any).
  • Laboratories submit a validated copy of the completed ICS statement received from the Product Provider to EMVCo prior to performing testing. The ICS statement is reviewed for accuracy and then archived for later comparison. The EMVCo CATA Secretariat will respond with a confirmation that all the submitted ICSs are acceptable for testing to the Main Laboratory.
  • All Laboratories perform appropriate testing of the submitted Product against the published test requirements and test cases.
  • Product Providers submit a completed Request for Approval form to EMVCo. Based on the RFA form EMVCo will provide Product Provider with an invoice.
  • Based on the received invoice the Product Provider shall settle the administrative fees with EMVCo.
  • On Product Provider’s request, the Laboratories submit the ICSs and test results (with checksum of the modules tested) to the EMVCo CATA Secretariat.
  • If the fee payment is confirmed by EMVCo Financial Secretariat, analysis of the ICS and test results by EMVCo and, if appropriate approval notification.
  • Type approved contactless Products are posted on the EMVCo web site after approval notification.
  • Approved products are retained by the Laboratory for a period of 4 years as of the date of approval. The Product Provider is responsible for providing support as necessary to maintain the Product in an operational state to accommodate any subsequent testing or analysis that may be deemed necessary by EMVCo.

MasterCard PayPass – Acceptance Device Approval Process

Overview of the ADA Process

  • Formal Device Approval Services Accreditation Requirements - Acceptance Device Approval.

  • The laboratory conducts the tests in a given order (performance testing first, as a “pass” to this test is considered as a binary Go-No Go decision). Additional tests are passed following an order mainly dictated by time saving considerations.
  • The current rule is that in no case can the samples under test be exchanged or modified neither by the product vendor nor the laboratory. In some exceptional cases MasterCard may grant such authorisation but this must be duly documented and formally requested to MasterCard (and authorization formally given).
  • In case the product does not pass the tests successfully, TUV SUD Product Service will inform the product vendor and ask whether they want to continue the test session for debug purposes.
  • Once all the tests have been run this event is time stamped (TS#06). The laboratory operator checks that all the tests results are recorded, and depending on the device assessed, whether the product is eligible for MasterCard approval. In case the product passed all the tests, the laboratory will draft a “Successful Test Assessment”.

TQM and PCI Processes

  • This section provides a short description for each of the additional processes for which a technical product must comply.

Terminal Quality Management

  • The “TQM Label” is unique reference allocated to an IFM/PCD following MasterCard’s acceptance of the TQM recommendation. Vendors will receive a “Statement of Compliance” listing all their TQM Labels. A physical label is not required to be attached to a terminal.
  • We send you a pack with all relevant documents that you are required to fill in, sign and send back to us. Then we send you an assessment proposal/quotation and we ask that you send us a purchase order. Once the PO is received and processed an initial invoice will be issued to you (please note that payment is split into two 50% invoice, the first 50% sent at the beginning of the application and the final 50% sent once TQM Label is received). In addition a project plan number will also be sent (please note PPNs are only sent to initial applications, if your application is a renewal this will be extended). Before we can initiate the planning of the audit we require the VOD and TIDs to be submitted. After the submission of both the VOD and the TID I will start planning your audit. Please also note that the process may take up to 6 months. For further information please

PCI PIN Entry Device Approval

  • For additional information and requirements for PCI PIN Entry Device Approval (PTS) please refer to

© TUV SUD LimitedSmartCards Quotation Notes – Issue 2.0February 2015Page 1 of 5

Top View